Update miniapp_leaderboard.py

miniapp_leaderboard.py

@@ -0,0 +1,728 @@
+import datetime
+import io
+import json
+import os
+import re
+import uuid
+from urllib.parse import urlparse
+
+import gradio as gr
+import pandas as pd
+import requests
+from huggingface_hub import HfApi, hf_hub_download
+from huggingface_hub.errors import RepositoryNotFoundError
+
+
+APP_NAME = "miniapp"
+
+# Space Secrets:
+# - HF_TOKEN: Hugging Face access token with WRITE access to the dataset repo
+# - LEADERBOARD_DATASET: dataset repo id like "ha251/miniapp-leaderboard"
+HF_TOKEN = os.environ.get("HF_TOKEN") or os.environ.get("TOKEN") or os.environ.get("HUGGINGFACE_TOKEN")
+LEADERBOARD_DATASET = (os.environ.get("LEADERBOARD_DATASET") or "").strip()
+MAX_ENTRIES = int(os.environ.get("MAX_ENTRIES", "500"))
+
+ENTRIES_PREFIX = "entries/"
+
+LEADERBOARD_COLUMNS = [
+    "Model name",
+    "Avg",
+    "Easy",
+    "Mid",
+    "Hard",
+    "Games",
+    "Science",
+    "Tools",
+    "Humanities",
+    "Viz",
+    "Lifestyle",
+    "Submitted at",
+    "Submitter",
+]
+
+NUMERIC_COLS = [
+    "Avg",
+    "Easy",
+    "Mid",
+    "Hard",
+    "Games",
+    "Science",
+    "Tools",
+    "Humanities",
+    "Viz",
+    "Lifestyle",
+]
+
+IN_SPACES = bool(
+    os.environ.get("SPACE_ID")
+    or os.environ.get("SPACE_REPO_NAME")
+    or os.environ.get("SPACE_AUTHOR_NAME")
+    or os.environ.get("system", "") == "spaces"
+)
+
+
+def _api() -> HfApi:
+    return HfApi(token=HF_TOKEN)
+
+
+def _is_valid_http_url(url: str) -> bool:
+    try:
+        parsed = urlparse(url)
+        return parsed.scheme in ("http", "https") and bool(parsed.netloc)
+    except Exception:
+        return False
+
+
+def _slug(s: str, max_len: int = 60) -> str:
+    s = (s or "").strip().lower()
+    s = re.sub(r"[^a-z0-9]+", "-", s)
+    s = re.sub(r"-{2,}", "-", s).strip("-")
+    return (s[:max_len] or "x")
+
+
+def _empty_df() -> pd.DataFrame:
+    return pd.DataFrame(columns=LEADERBOARD_COLUMNS)
+
+
+def _ensure_dataset_readable() -> tuple[bool, str]:
+    if not HF_TOKEN:
+        return False, "Space is missing HF_TOKEN (Secrets)."
+    if not LEADERBOARD_DATASET:
+        return False, "Space is missing LEADERBOARD_DATASET (Secrets)."
+    api = _api()
+    try:
+        api.repo_info(repo_id=LEADERBOARD_DATASET, repo_type="dataset")
+        return True, ""
+    except RepositoryNotFoundError:
+        return False, (
+            f"Dataset repo not found: {LEADERBOARD_DATASET}. "
+            "Create it first (as a dataset) or fix LEADERBOARD_DATASET."
+        )
+    except Exception:
+        return False, "Cannot access the dataset repo. Check token permissions."
+
+
+def _list_entry_files() -> list[str]:
+    ok, _ = _ensure_dataset_readable()
+    if not ok:
+        return []
+    api = _api()
+    try:
+        files = api.list_repo_files(repo_id=LEADERBOARD_DATASET, repo_type="dataset")
+    except Exception:
+        return []
+
+    entry_files = [f for f in files if f.startswith(ENTRIES_PREFIX) and f.endswith(".json")]
+    entry_files.sort(reverse=True)
+    return entry_files[:MAX_ENTRIES]
+
+
+def _load_entries_df() -> pd.DataFrame:
+    ok, _ = _ensure_dataset_readable()
+    if not ok:
+        return _empty_df()
+
+    rows: list[dict] = []
+    for filename in _list_entry_files():
+        try:
+            path = hf_hub_download(
+                repo_id=LEADERBOARD_DATASET,
+                repo_type="dataset",
+                filename=filename,
+                token=HF_TOKEN,
+            )
+            with open(path, "r", encoding="utf-8") as fp:
+                row = json.load(fp)
+                rows.append(row)
+        except Exception:
+            continue
+
+    if not rows:
+        return _empty_df()
+
+    df = pd.DataFrame(rows)
+    for c in LEADERBOARD_COLUMNS:
+        if c not in df.columns:
+            df[c] = ""
+    df = df[LEADERBOARD_COLUMNS]
+    for c in NUMERIC_COLS:
+        df[c] = pd.to_numeric(df[c], errors="coerce")
+    df = df.sort_values(by=["Submitted at"], ascending=False, kind="stable")
+    return df
+
+
+def _apply_search_and_sort(
+    df: pd.DataFrame,
+    search_text: str,
+    search_in: str,
+    sort_by: str,
+    sort_order: str,
+) -> pd.DataFrame:
+    search_text = (search_text or "").strip().lower()
+    if search_text:
+        if search_in == "Model name":
+            df = df[df["Model name"].astype(str).str.lower().str.contains(search_text, na=False)]
+        elif search_in == "Submitter":
+            df = df[df["Submitter"].astype(str).str.lower().str.contains(search_text, na=False)]
+        else:
+            mask = (
+                df["Model name"].astype(str).str.lower().str.contains(search_text, na=False)
+                | df["Submitter"].astype(str).str.lower().str.contains(search_text, na=False)
+            )
+            df = df[mask]
+
+    ascending = sort_order == "Ascending"
+    if sort_by in df.columns:
+        df = df.sort_values(by=[sort_by], ascending=ascending, kind="stable", na_position="last")
+    return df
+
+
+def refresh(search_text: str, search_in: str, sort_by: str, sort_order: str):
+    df = _load_entries_df()
+    return _apply_search_and_sort(df, search_text, search_in, sort_by, sort_order)
+
+
+def _parse_hf_created_at(created_at: str) -> datetime.datetime | None:
+    try:
+        if created_at.endswith("Z"):
+            created_at = created_at[:-1] + "+00:00"
+        return datetime.datetime.fromisoformat(created_at)
+    except Exception:
+        return None
+
+
+def _check_user_eligibility(username: str) -> tuple[bool, str]:
+    """
+    - Must be older than ~4 months (>= 120 days)
+    """
+    try:
+        r = requests.get(f"https://huggingface.co/api/users/{username}/overview", timeout=10)
+        r.raise_for_status()
+        created_at = r.json().get("createdAt")
+        if not created_at:
+            return False, "Cannot verify account creation date."
+        dt = _parse_hf_created_at(created_at)
+        if not dt:
+            return False, "Cannot parse account creation date."
+        now = datetime.datetime.now(datetime.timezone.utc)
+        if dt.tzinfo is None:
+            dt = dt.replace(tzinfo=datetime.timezone.utc)
+        age_days = (now - dt).days
+        if age_days < 120:
+            return False, "Account must be older than 4 months to submit."
+        return True, ""
+    except Exception:
+        return False, "Cannot verify Hugging Face account. Please try again later."
+
+
+def _submitted_today(username: str) -> bool:
+    df = _load_entries_df()
+    if df.empty:
+        return False
+    today = datetime.datetime.utcnow().date().isoformat()
+    user_rows = df[df["Submitter"].astype(str) == username]
+    if user_rows.empty:
+        return False
+    return any(str(v).startswith(today) for v in user_rows["Submitted at"].tolist())
+
+
+def submit(
+    model_name: str,
+    model_api: str,
+    api_key: str,
+    avg: float,
+    easy: float,
+    mid: float,
+    hard: float,
+    games: float,
+    science: float,
+    tools: float,
+    humanities: float,
+    viz: float,
+    lifestyle: float,
+    search_text: str,
+    search_in: str,
+    sort_by: str,
+    sort_order: str,
+    profile: gr.OAuthProfile | None,
+):
+    # Login required to submit (in Spaces)
+    if IN_SPACES and (profile is None or not getattr(profile, "username", None)):
+        return "You must log in to submit.", refresh(search_text, search_in, sort_by, sort_order)
+
+    submitter = (getattr(profile, "username", None) if profile is not None else "local") or "anonymous"
+
+    model_name = (model_name or "").strip()
+    model_api = (model_api or "").strip()
+    api_key = (api_key or "").strip()
+
+    if not model_name:
+        return "Model name is required.", refresh(search_text, search_in, sort_by, sort_order)
+    if not model_api:
+        return "Model API URL is required.", refresh(search_text, search_in, sort_by, sort_order)
+    if not _is_valid_http_url(model_api):
+        return "Model API must be a valid http(s) URL.", refresh(search_text, search_in, sort_by, sort_order)
+    if not api_key:
+        return "API key is required.", refresh(search_text, search_in, sort_by, sort_order)
+
+    ok, msg = _ensure_dataset_readable()
+    if not ok:
+        return msg, refresh(search_text, search_in, sort_by, sort_order)
+
+    if IN_SPACES:
+        ok, msg = _check_user_eligibility(submitter)
+        if not ok:
+            return msg, refresh(search_text, search_in, sort_by, sort_order)
+
+    if _submitted_today(submitter):
+        return "You have already submitted today. Please try again tomorrow.", refresh(search_text, search_in, sort_by, sort_order)
+
+    now = datetime.datetime.utcnow().replace(microsecond=0).isoformat() + "Z"
+    nonce = uuid.uuid4().hex[:8]
+    safe_model = _slug(model_name)
+    safe_user = _slug(submitter)
+    path_in_repo = f"{ENTRIES_PREFIX}{now[:10]}/{now}-{safe_user}-{safe_model}-{nonce}.json"
+
+    # NOTE: api_key is collected but NOT stored.
+    payload = {
+        "Model name": model_name,
+        "Avg": avg,
+        "Easy": easy,
+        "Mid": mid,
+        "Hard": hard,
+        "Games": games,
+        "Science": science,
+        "Tools": tools,
+        "Humanities": humanities,
+        "Viz": viz,
+        "Lifestyle": lifestyle,
+        "Submitted at": now,
+        "Submitter": submitter,
+        "Model API": model_api,
+    }
+
+    api = _api()
+    data = (json.dumps(payload, ensure_ascii=False, indent=2) + "\n").encode("utf-8")
+    api.upload_file(
+        repo_id=LEADERBOARD_DATASET,
+        repo_type="dataset",
+        path_or_fileobj=io.BytesIO(data),
+        path_in_repo=path_in_repo,
+        commit_message=f"miniapp: submit {submitter}/{model_name}",
+        token=HF_TOKEN,
+    )
+
+    return "Submitted successfully.", refresh(search_text, search_in, sort_by, sort_order)
+
+
+with gr.Blocks(title=f"{APP_NAME} leaderboard") as demo:
+    # Layout: Overview -> Leaderboard -> Submission instructions
+    gr.Markdown(
+        f"## {APP_NAME} leaderboard\n\n"
+        "### Overview\n"
+        "_Placeholder overview text. Replace this with your benchmark description, rules, and links._\n\n"
+        "### Leaderboard\n"
+        "_The leaderboard below supports sorting and searching._\n\n"
+        "### Submission\n"
+        "_Placeholder submission instructions. Requires login. One submission per user per day. "
+        "Account must be older than 4 months._\n"
+    )
+
+    with gr.Row():
+        with gr.Column(scale=3):
+            with gr.Row():
+                search_text = gr.Textbox(label="Search", placeholder="Model name or submitter")
+                search_in = gr.Dropdown(
+                    label="Search in",
+                    choices=["Both", "Model name", "Submitter"],
+                    value="Both",
+                )
+            with gr.Row():
+                sort_by = gr.Dropdown(label="Sort by", choices=LEADERBOARD_COLUMNS, value="Avg")
+                sort_order = gr.Radio(label="Order", choices=["Descending", "Ascending"], value="Descending")
+                refresh_btn = gr.Button("Refresh")
+
+            leaderboard = gr.Dataframe(
+                label="Leaderboard",
+                value=_load_entries_df(),
+                interactive=False,
+                wrap=True,
+            )
+
+        with gr.Column(scale=2):
+            with gr.Accordion("Submit (login required)", open=True):
+                model_name = gr.Textbox(label="Model name (required)")
+                model_api = gr.Textbox(label="Model API (required)", placeholder="https://...")
+                api_key = gr.Textbox(label="API key (required)", type="password", placeholder="Will not be stored")
+
+                with gr.Row():
+                    avg = gr.Number(label="Avg", value=0)
+                    easy = gr.Number(label="Easy", value=0)
+                    mid = gr.Number(label="Mid", value=0)
+                    hard = gr.Number(label="Hard", value=0)
+
+                with gr.Row():
+                    games = gr.Number(label="Games", value=0)
+                    science = gr.Number(label="Science", value=0)
+                    tools = gr.Number(label="Tools", value=0)
+
+                with gr.Row():
+                    humanities = gr.Number(label="Humanities", value=0)
+                    viz = gr.Number(label="Viz", value=0)
+                    lifestyle = gr.Number(label="Lifestyle", value=0)
+
+                with gr.Row():
+                    gr.LoginButton()
+                    submit_btn = gr.Button("Submit", variant="primary")
+                status = gr.Markdown()
+
+    refresh_btn.click(refresh, inputs=[search_text, search_in, sort_by, sort_order], outputs=[leaderboard])
+    submit_btn.click(
+        submit,
+        inputs=[
+            model_name,
+            model_api,
+            api_key,
+            avg,
+            easy,
+            mid,
+            hard,
+            games,
+            science,
+            tools,
+            humanities,
+            viz,
+            lifestyle,
+            search_text,
+            search_in,
+            sort_by,
+            sort_order,
+        ],
+        outputs=[status, leaderboard],
+    )
+
+demo.launch()
+
+import datetime
+import io
+import json
+import os
+import re
+import uuid
+from urllib.parse import urlparse
+
+import gradio as gr
+import pandas as pd
+from huggingface_hub import HfApi, hf_hub_download
+
+
+APP_NAME = "miniapp"
+
+# 在 Space 里通过 Secrets 配置：
+# - HF_TOKEN: 具有写 dataset 权限的 token（Settings -> Variables and secrets -> Secrets）
+# - LEADERBOARD_DATASET: 形如 "your-username/miniapp-leaderboard"（repo_type=dataset）
+HF_TOKEN = os.environ.get("HF_TOKEN") or os.environ.get("TOKEN") or os.environ.get("HUGGINGFACE_TOKEN")
+LEADERBOARD_DATASET = os.environ.get("LEADERBOARD_DATASET", "").strip()
+# Owner 审核口令（放到 Space Secrets；不要放到公开 Variables）
+OWNER_REVIEW_TOKEN = os.environ.get("OWNER_REVIEW_TOKEN", "").strip()
+
+# 判断是否运行在 Hugging Face Spaces
+IN_SPACES = bool(
+    os.environ.get("SPACE_ID")
+    or os.environ.get("SPACE_REPO_NAME")
+    or os.environ.get("SPACE_AUTHOR_NAME")
+    or os.environ.get("system", "") == "spaces"
+)
+
+MAX_ENTRIES = int(os.environ.get("MAX_ENTRIES", "200"))
+
+PENDING_PREFIX = "pending/"
+APPROVED_PREFIX = "approved/"
+
+
+def _is_valid_http_url(url: str) -> bool:
+    try:
+        parsed = urlparse(url)
+        return parsed.scheme in ("http", "https") and bool(parsed.netloc)
+    except Exception:
+        return False
+
+
+def _slug(s: str, max_len: int = 60) -> str:
+    s = (s or "").strip().lower()
+    s = re.sub(r"[^a-z0-9]+", "-", s)
+    s = re.sub(r"-{2,}", "-", s).strip("-")
+    return (s[:max_len] or "model")
+
+
+def _api() -> HfApi:
+    return HfApi(token=HF_TOKEN)
+
+
+def _ensure_dataset_repo():
+    if not HF_TOKEN:
+        raise RuntimeError("未配置 HF_TOKEN（Space Secrets）。")
+    if not LEADERBOARD_DATASET:
+        raise RuntimeError("未配置 LEADERBOARD_DATASET（例如：your-username/miniapp-leaderboard）。")
+    api = _api()
+    try:
+        api.repo_info(repo_id=LEADERBOARD_DATASET, repo_type="dataset")
+    except Exception:
+        # 不存在则创建（public dataset；你也可以手动创建并设为 private）
+        api.create_repo(repo_id=LEADERBOARD_DATASET, repo_type="dataset", private=False, exist_ok=True)
+
+
+def _empty_df() -> pd.DataFrame:
+    return pd.DataFrame(columns=["submitted_at", "username", "model_name", "model_api", "notes"])
+
+
+def _list_json_files(prefix: str) -> list[str]:
+    if not HF_TOKEN or not LEADERBOARD_DATASET:
+        return []
+
+    api = _api()
+    try:
+        files = api.list_repo_files(repo_id=LEADERBOARD_DATASET, repo_type="dataset")
+    except Exception:
+        return []
+
+    return sorted(
+        [f for f in files if f.startswith(prefix) and f.endswith(".json")],
+        reverse=True,
+    )[:MAX_ENTRIES]
+
+
+def _load_entries_df(prefix: str, include_filename: bool) -> pd.DataFrame:
+    files = _list_json_files(prefix)
+    rows = []
+    for filename in files:
+        try:
+            path = hf_hub_download(
+                repo_id=LEADERBOARD_DATASET,
+                repo_type="dataset",
+                filename=filename,
+                token=HF_TOKEN,
+            )
+            with open(path, "r", encoding="utf-8") as fp:
+                row = json.load(fp)
+                if include_filename:
+                    row["_filename"] = filename
+                rows.append(row)
+        except Exception:
+            continue
+
+    if not rows:
+        df = _empty_df()
+        if include_filename:
+            df["_filename"] = []
+        return df
+
+    df = pd.DataFrame(rows)
+    for col in ["submitted_at", "username", "model_name", "model_api", "notes"]:
+        if col not in df.columns:
+            df[col] = ""
+    cols = ["submitted_at", "username", "model_name", "model_api", "notes"]
+    if include_filename:
+        if "_filename" not in df.columns:
+            df["_filename"] = ""
+        cols = cols + ["_filename"]
+    df = df[cols]
+    df = df.sort_values(by=["submitted_at"], ascending=False, kind="stable")
+    return df
+
+
+def refresh():
+    return _load_entries_df(APPROVED_PREFIX, include_filename=False)
+
+
+def refresh_pending():
+    df = _load_entries_df(PENDING_PREFIX, include_filename=True)
+    choices = list(df["_filename"]) if "_filename" in df.columns else []
+    return df, gr.update(choices=choices, value=choices[0] if choices else None)
+
+
+def submit(model_name: str, model_api: str, notes: str, username: str | None):
+    model_name = (model_name or "").strip()
+    model_api = (model_api or "").strip()
+    notes = (notes or "").strip()
+    username = (username or "").strip() or ("local" if not IN_SPACES else "anonymous")
+
+    if not model_name:
+        return "请填写 **模型名称**。", refresh()
+    if not model_api:
+        return "请填写 **模型 API**。", refresh()
+    if not _is_valid_http_url(model_api):
+        return "**模型 API** 需要是合法的 `http(s)://...` URL。", refresh()
+
+    if not HF_TOKEN:
+        return "Space 未配置 **HF_TOKEN**（Secrets），无法写入排行榜。", refresh()
+    if not LEADERBOARD_DATASET:
+        return "Space 未配置 **LEADERBOARD_DATASET**（例如：`your-username/miniapp-leaderboard`）。", refresh()
+
+    _ensure_dataset_repo()
+    api = _api()
+
+    now = datetime.datetime.utcnow().replace(microsecond=0).isoformat() + "Z"
+    safe_model = _slug(model_name)
+    safe_user = _slug(username)
+    nonce = uuid.uuid4().hex[:8]
+    path_in_repo = f"{PENDING_PREFIX}{now[:10]}/{now}-{safe_user}-{safe_model}-{nonce}.json"
+
+    payload = {
+        "submitted_at": now,
+        "username": username,
+        "model_name": model_name,
+        "model_api": model_api,
+        "notes": notes,
+    }
+    data = (json.dumps(payload, ensure_ascii=False, indent=2) + "\n").encode("utf-8")
+    bio = io.BytesIO(data)
+
+    api.upload_file(
+        repo_id=LEADERBOARD_DATASET,
+        repo_type="dataset",
+        path_or_fileobj=bio,
+        path_in_repo=path_in_repo,
+        commit_message=f"miniapp: submit(pending) {username}/{model_name}",
+        token=HF_TOKEN,
+    )
+
+    return "已提交，等待 owner 审核后才会上榜。", refresh()
+
+
+def approve(pending_filename: str | None, review_token: str | None):
+    pending_filename = (pending_filename or "").strip()
+    review_token = (review_token or "").strip()
+
+    if not pending_filename:
+        df, dd = refresh_pending()
+        return "请选择一条待审核提交。", df, dd, refresh()
+
+    if not OWNER_REVIEW_TOKEN:
+        df, dd = refresh_pending()
+        return "Space 未配置 **OWNER_REVIEW_TOKEN**（Secrets），无法启用审核。", df, dd, refresh()
+
+    if review_token != OWNER_REVIEW_TOKEN:
+        df, dd = refresh_pending()
+        return "审核口令不正确。", df, dd, refresh()
+
+    if not HF_TOKEN or not LEADERBOARD_DATASET:
+        df, dd = refresh_pending()
+        return "Space 未配置 HF 写入权限，无法审核。", df, dd, refresh()
+
+    api = _api()
+    try:
+        local_path = hf_hub_download(
+            repo_id=LEADERBOARD_DATASET,
+            repo_type="dataset",
+            filename=pending_filename,
+            token=HF_TOKEN,
+        )
+        with open(local_path, "r", encoding="utf-8") as fp:
+            payload = json.load(fp)
+    except Exception as e:
+        df, dd = refresh_pending()
+        return f"读取待审核文件失败：{e}", df, dd, refresh()
+
+    # 将文件复制到 approved 目录（保留原提交时间等字段）
+    base = pending_filename[len(PENDING_PREFIX) :] if pending_filename.startswith(PENDING_PREFIX) else pending_filename
+    approved_filename = f"{APPROVED_PREFIX}{base}"
+    data = (json.dumps(payload, ensure_ascii=False, indent=2) + "\n").encode("utf-8")
+    bio = io.BytesIO(data)
+
+    try:
+        api.upload_file(
+            repo_id=LEADERBOARD_DATASET,
+            repo_type="dataset",
+            path_or_fileobj=bio,
+            path_in_repo=approved_filename,
+            commit_message=f"miniapp: approve {payload.get('username','')}/{payload.get('model_name','')}",
+            token=HF_TOKEN,
+        )
+        # 删除 pending 原文件（真正“上榜前审核”）
+        api.delete_file(
+            repo_id=LEADERBOARD_DATASET,
+            repo_type="dataset",
+            path_in_repo=pending_filename,
+            commit_message=f"miniapp: remove pending {pending_filename}",
+            token=HF_TOKEN,
+        )
+    except Exception as e:
+        df, dd = refresh_pending()
+        return f"审核写入失败：{e}", df, dd, refresh()
+
+    pending_df, pending_dd = refresh_pending()
+    approved_df = refresh()
+    return "已通过审核并更新榜单。", pending_df, pending_dd, approved_df
+
+
+with gr.Blocks(title=f"{APP_NAME} leaderboard") as demo:
+    gr.Markdown(
+        f"## {APP_NAME} leaderboard\n\n"
+        "用户提交信息后会进入 **pending（待审核）**；owner 审核通过后才会进入 **approved（上榜）**。\n\n"
+        f"- 当前 `LEADERBOARD_DATASET`: `{LEADERBOARD_DATASET or '(未配置)'}`\n"
+    )
+
+    with gr.Row():
+        with gr.Column(scale=2):
+            model_name = gr.Textbox(label="模型名称（必填）", placeholder="例如：my-agent-v1")
+            model_api = gr.Textbox(
+                label="模型 API（必填）",
+                placeholder="例如：https://api.example.com/v1/chat/completions",
+            )
+            notes = gr.Textbox(label="备注（可选）", lines=4)
+            username = gr.Textbox(
+                label="用户名（可选）",
+                placeholder="建议填你的 HF 用户名（也可留空）",
+                value="" if IN_SPACES else "local",
+            )
+            submit_btn = gr.Button("提交", variant="primary")
+            status = gr.Markdown()
+        with gr.Column(scale=3):
+            leaderboard = gr.Dataframe(
+                label="Leaderboard（按提交时间倒序）",
+                value=_load_entries_df(APPROVED_PREFIX, include_filename=False),
+                interactive=False,
+                wrap=True,
+            )
+            refresh_btn = gr.Button("刷新")
+
+    submit_btn.click(
+        submit,
+        inputs=[model_name, model_api, notes, username],
+        outputs=[status, leaderboard],
+    )
+    refresh_btn.click(refresh, inputs=[], outputs=[leaderboard])
+
+    with gr.Accordion("Owner 审核（测试 demo）", open=False):
+        gr.Markdown(
+            "需要在 Space Secrets 中配置 `OWNER_REVIEW_TOKEN`。只有输入正确口令，才允许把 pending 放入榜单。"
+        )
+        review_token = gr.Textbox(label="审核口令", type="password", placeholder="OWNER_REVIEW_TOKEN")
+        pending_refresh_btn = gr.Button("刷新待审核列表")
+        pending_df = gr.Dataframe(
+            label="待审核（pending）",
+            value=_load_entries_df(PENDING_PREFIX, include_filename=True),
+            interactive=False,
+            wrap=True,
+        )
+        pending_pick = gr.Dropdown(
+            label="选择要通过的提交（文件）",
+            choices=_list_json_files(PENDING_PREFIX),
+        )
+        approve_btn = gr.Button("通过审核并上榜", variant="primary")
+        approve_status = gr.Markdown()
+
+        pending_refresh_btn.click(
+            refresh_pending,
+            inputs=[],
+            outputs=[pending_df, pending_pick],
+        )
+        approve_btn.click(
+            approve,
+            inputs=[pending_pick, review_token],
+            outputs=[approve_status, pending_df, pending_pick, leaderboard],
+        )
+
+demo.launch()
+